{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# setup \n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {},
   "outputs": [],
   "source": [
    "# simple 101 group\n",
    "F101 = IntegerModRing(101)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {},
   "outputs": [],
   "source": [
    "# define elliptic curve with coefficient 0(degree 1), 3(degree 0)\n",
    "E = EllipticCurve(F101, [0,3])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 43,
   "metadata": {},
   "outputs": [],
   "source": [
    "# define polynomial ring on F101, then extended in Galois field\n",
    "R.<X> = PolynomialRing(F101)\n",
    "K.<X> = GF(101**2, modulus = x^2+2)\n",
    "E2 = EllipticCurve(K, [0,3])\n",
    "# EC generator at  (1,2)\n",
    "G=E2([1,2])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "metadata": {},
   "outputs": [],
   "source": [
    "# the order of G is r=17, the embedding degree it's the smallest k such that r|p^k -1, thus k=2\n",
    "## if you keep adding G to itself, it would get only 17 unique values r=17\n",
    "## group base p=101\n",
    "G2 = E2([36,31*X])\n",
    "# structured reference string SRS\n",
    "## in kate commitment, here you create SRS, and release the toxic waste\n",
    "## for random value rand=2\n",
    "rand=2\n",
    "G1_SRS = [(rand**i)*G for i in range(7)]\n",
    "G2_SRS = [rand**i*G2 for i in range(2)]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [],
   "source": [
    "N=G.order()\n",
    "F17=Integers(N)\n",
    "F17.square_roots_of_one()\n",
    "# witness values for random [1,4,-1,-4]\n",
    "w = vector(F17, [1,4,-1,-4])\n",
    "w\n",
    "k1=2; k2=3\n",
    "k1*w\n",
    "k2*w\n",
    "A = matrix(F17, [[1**i for i in range (4)], [4**i for i in range (4)], [16**i for i in range(4)], [13**i for i in range(4)]])\n",
    "Ai = A.inverse()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {},
   "outputs": [],
   "source": [
    "s=2\n",
    "zeta=5\n",
    "beta=12\n",
    "gamma=13\n",
    "vega=12\n",
    "alpha = 15\n",
    "ql_coef = [0,0,1,0] # multiplication a1*b1 : q left mulitplication coefficient for l+ r + m + c  = rhs\n",
    "qr_coef = [0,0,1,0] # multiplication a2*b2'\n",
    "qm_coef = [1,1,0,0] # addition gate a3+b3\n",
    "qo_coef = [-1,-1,0,0] # ??\n",
    "qc_coef = [0,0,-30,0] #??\n",
    "P.<x> = F17[];x=P.0\n",
    "ql = P(list(Ai*vector(F17, ql_coef)))\n",
    "qr = P(list(Ai*vector(F17, qr_coef)))\n",
    "qm = P(list(Ai*vector(F17, qm_coef)))\n",
    "qo = P(list(Ai*vector(F17, qo_coef)))\n",
    "qc = P(list(Ai*vector(F17, qc_coef)))\n",
    "#public setup polynomials SRS are ql,qr,qm,qo,qc\n",
    "ql,qr,qm,qo,qc\n",
    "#\n",
    "# equality constraints ??\n",
    "sa = P(list(Ai*vector(F17, [2,3,12,13]))) # ??\n",
    "sb = P(list(Ai*vector(F17, [1,15,8,9]))) # ??\n",
    "sc = P(list(Ai*vector(F17, [4,16,14,5]))) # ?? \n",
    "sa,sb,sc\n",
    "# blinding values bld1-bld9\n",
    "bld1=7\n",
    "bld2=4\n",
    "bld3=11\n",
    "bld4=12\n",
    "bld5=16\n",
    "bld6=2\n",
    "bld7=14\n",
    "bld8=2\n",
    "bld9=11"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# proving"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 57,
   "metadata": {},
   "outputs": [],
   "source": [
    "def proving():\n",
    "        ## for root 3, the following toxic waste coefficient are:\n",
    "        a_coef = [3,9,27,0] # the left operands: a1,a2,a3,a5 \n",
    "        b_coef = [3,3,3,0] # the right operands: b1,b2,b3,b5\n",
    "        c_coef = [9,27,0,0] # the output: c1,c2,c3,c5\n",
    "        fa = P(list(Ai*vector(F17, a_coef)))\n",
    "        fb = P(list(Ai*vector(F17, b_coef)))\n",
    "        fc = P(list(Ai*vector(F17, c_coef)))\n",
    "        # solution polynomials are fa,fb,fc\n",
    "        # round 1\n",
    "        # target polynomial that vanishes at root of unity \n",
    "        Z = x**4-1\n",
    "        # random blinding values b1-b9 = [7,4,11,12,16,2]\n",
    "        a = (bld1*x+bld2)*Z+fa\n",
    "        b = (bld3*x+bld4)*Z+fb\n",
    "        c = (bld5*x+bld6)*Z+fc\n",
    "        ### choose s=2\n",
    "        a_s = ZZ(a(s))*G\n",
    "        b_s = ZZ(b(s))*G\n",
    "        c_s = ZZ(c(s))*G\n",
    "        p = (a_s,b_s,c_s)\n",
    "        # round 2\n",
    "        ### compute permutation challenges (beta,gamma) as hash of the transcript\n",
    "        #for simplicity\n",
    "        acc=1 #accumulator\n",
    "        for i in range(4): #TODO parameterize number of gates\n",
    "            nominator = ((a(w[i])+beta*w[i]+gamma)*(b(w[i])+beta*k1*w[i]+gamma)*(c(w[i])+beta*k2*w[i]+gamma))\n",
    "            denominator = ((a(w[i])+beta*sa(w[i])+gamma)*(b(w[i])+beta*sb(w[i])+gamma)*(c(w[i])+beta*sc(w[i])+gamma))\n",
    "            acc = acc*nominator/denominator\n",
    "        acc=P(list(Ai*vector(F17,[1,12,10,1]))) #TODO parameterize\n",
    "        Zx = (bld7*x**bld8+bld9*x+7)*Z+acc\n",
    "        Z_s = ZZ(Zx(s))*G\n",
    "        # round 3\n",
    "        L=P(list(Ai*vector(F17, [1,0,0,0]))) #TODO parameterize\n",
    "        t1Z = a*b*qm+a*ql+b*qr+c*qo+qc\n",
    "        t2Z = (a+beta*x+gamma)*(b+k1*beta*x+gamma)*(c+k2*beta*x+gamma)*Zx*alpha\n",
    "        Zw = Zx(w[1]*x)\n",
    "        t3Z= -(a+beta*sa+gamma)*(b+beta*sb+gamma)*(c+beta*sc+gamma)*Zw*alpha\n",
    "        t4Z = (Zx-1)*L*alpha**2\n",
    "        tZ = t1Z+t2Z+t3Z+t4Z\n",
    "        ## if everything goes well, then the following should divide without remainders\n",
    "        t=P(tZ/Z)\n",
    "        t_list = t.list()\n",
    "        t_lo=t_list[0:6]\n",
    "        t_mid=t_list[6:12]\n",
    "        t_hi=t_list[12:]\n",
    "        t_lo_s=ZZ(P(t_lo)(s))*G\n",
    "        t_mid_s=ZZ(P(t_mid)(s))*G\n",
    "        t_hi_s=ZZ(P(t_hi)(s))*G\n",
    "        t_lo_s,t_mid_s,t_hi_s\n",
    "        # Round 4\n",
    "        a_=a(zeta)\n",
    "        b_=b(zeta)\n",
    "        c_=c(zeta)\n",
    "        sa_=sa(zeta)\n",
    "        sb_=sb(zeta)\n",
    "        t_=t(zeta)\n",
    "        zw_=Zx(zeta*w[1])\n",
    "        l_=L(zeta)\n",
    "        r1 = a_*b_*qm+a_*ql+b_*qr+c_*qo+qc\n",
    "        r2 = ((a_+beta*zeta+gamma)*(b_+beta*k1*zeta+gamma)*(c_+beta*k2*zeta+gamma)*Zx)*alpha\n",
    "        r3=-(a_+beta*sa_+gamma)*(b_+beta*sb_+gamma)*beta*zw_*sc*alpha\n",
    "        r4=Zx*l_*alpha**2\n",
    "        r=r1+r2+r3+r4\n",
    "        r_=r(zeta)\n",
    "        # Round 5\n",
    "        v1 = P(t_lo)\n",
    "        v2=zeta**6*P(t_mid)\n",
    "        v3=zeta**12*P(t_hi)\n",
    "        v4=-t_\n",
    "        v5 = vega*(r-r_)+vega**2*(a-a_)+vega**3*(b-b_)+vega**4*(c-c_)+vega**5*(sa-sa_)+vega**6*(sb-sb_)\n",
    "        W=v1+v2+v3+v4+v5\n",
    "        ## opening proof polynomial\n",
    "        Wz=W/(x-zeta)\n",
    "        Wzw=(Zx-zw_)/(x-zeta*w[1])\n",
    "        Wz_s=ZZ(Wz(s))*G\n",
    "        Wzw_s=ZZ(Wzw(s))*G\n",
    "        Wz_s,Wzw_s\n",
    "        proof = (a_s,b_s,c_s,Z_s,t_lo_s,t_mid_s,t_hi_s,Wz_s,Wzw_s,a_,b_,c_,sa_,sb_,r_,zw_)\n",
    "        return proof"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 58,
   "metadata": {},
   "outputs": [],
   "source": [
    "a_s,b_s,c_s,Z_s,t_lo_s,t_mid_s,t_hi_s,Wz_s,Wzw_s,a_,b_,c_,sa_,sb_,r_,zw_ = proving()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# verification"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 61,
   "metadata": {},
   "outputs": [],
   "source": [
    "def verify():\n",
    "    ## TODO (1) verify that all those points are in the curve G1\n",
    "    ## TODO (2) verify that the bar values are part of Fp^7 group\n",
    "    ## TODO (3) validate that w_i (roots of unity) are in F_p^l\n",
    "    ### verifier processed input\n",
    "    qm_s = ZZ(qm(s))*G\n",
    "    ql_s = ZZ(ql(s))*G\n",
    "    qr_s = ZZ(qr(s))*G\n",
    "    qo_s = ZZ(qo(s))*G\n",
    "    qc_s = ZZ(qc(s))*G\n",
    "    sa_s = ZZ(sa(s))*G\n",
    "    sb_s = ZZ(sb(s))*G\n",
    "    sc_s = ZZ(sc(s))*G\n",
    "    ## (4) compute challenges beta, gamma, alpha, zeta, veta, upsilon as in prover description from the common inputs, public input, and elements of zk-snark\n",
    "    epsilon=4 # only this is missing\n",
    "    ## (5) ZERO POLYNOMIAL EVALUATION\n",
    "    Z_z=F17(zeta**4-1)\n",
    "    ## (6) lagrange polynomial evaluation \n",
    "    L1_z=F17((zeta**4-1)/(4*(zeta-1)))\n",
    "    ## TODO(7) public input polynomial evaluation \n",
    "    ## quotient polynomial evaluation\n",
    "    t_=(r_-((a_+beta*sa_+gamma)*(b_+beta*sb_+gamma)*(c_+gamma)*zw_)*alpha-L1_z*alpha**2)/Z_z;t_\n",
    "    ## (9) part of batched opynomimal commitment\n",
    "    d1=ZZ(a_*b_*vega)*qm_s+ZZ(a_*vega)*ql_s+ZZ(b_*vega)*qr_s+ZZ(c_*vega)*qo_s+vega*qc_s\n",
    "    d2=ZZ(((a_+beta*zeta+gamma)*(b_+beta*k1*zeta+gamma)*(c_+beta*k2*zeta+gamma)*alpha*vega)+L1_z*alpha**2*vega+F17(epsilon))*Z_s\n",
    "    d3=-ZZ((a_+beta*sa_+gamma)*(b_+beta*sb_+gamma)*alpha*vega*beta*zw_)*sc_s\n",
    "    d=d1+d2+d3;d\n",
    "    ## (10) full batched polynomial commitment [F]1\n",
    "    f=t_lo_s+zeta**6*t_mid_s+zeta**12*t_hi_s+d+vega**2*a_s+vega**3*b_s+vega**4*c_s+vega**5*sa_s+vega**6*sb_s\n",
    "    ## (11) group-encoded batch evaluation [E]1\n",
    "    e=ZZ((t_+vega*r_+vega**2*a_+vega**3*b_+vega**4*c_+vega**5*sa_+vega**6*sb_+epsilon*zw_))*G\n",
    "    ## (12)\n",
    "    x1=Wz_s+epsilon*Wzw_s\n",
    "    x2=s*G2\n",
    "    y1=zeta*Wz_s+ZZ(epsilon*zeta*w[1])*Wzw_s+f-e\n",
    "    y2=G2\n",
    "    x1_=E2(x1)\n",
    "    x2_=E2(x2)\n",
    "    y1_=E2(y1)\n",
    "    y2_=E2(y2)\n",
    "    return x1_.weil_pairing(x2_,17)==y1_.weil_pairing(y2_,17)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 62,
   "metadata": {},
   "outputs": [],
   "source": [
    "assert(verify())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### references\n",
    "[1] https://eprint.iacr.org/2019/953.pdf\n",
    "\n",
    "[2] https://research.metastate.dev/plonk-by-hand-part-1/\n",
    "\n",
    "[3] https://research.metastate.dev/plonk-by-hand-part-2-the-proof/\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "SageMath 9.3",
   "language": "sage",
   "name": "sagemath"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.10"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}
